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EXHIBIT H - 

(U) QUERYING PROCEDURES USED BY THE NATIONAL SECURES ' B PH £«; on 
AGENCY IN CONNECTION WITH ACQUISITIONS OF FOREIGN 
INTELLIGENCE INFORMATION PURSUANT TO SECTION 702 OjF THE,v j V L 
FOREIGN INTELLIGENCE SURVEILLANCE ACT OF 1978, AS AMENDED 

I. (U) These procedures apply to the querying of unminimized information, acquired pursuant 
to section 702 of the Foreign Intelligence Surveillance Act of 1978, as amended (“FISA” or “the 
Act”), by the National Security Agency (“NSA”), and apply in addition to separate minimization 
procedures for NSA adopted pursuant to subsection 702(e) of the Act. These querying 
procedures should be read and applied in conjunction with those minimization procedures, and 
nothing in these procedures permits any actions that would otherwise be prohibited by those 
minimization procedures. NSA personnel who have completed training in these procedures and 
NSA’s section 702 minimization procedures may query NSA systems containing unminimized 
information acquired pursuant to section 702 of the Act. Authorized users with access to 
unminimized section 702-acquired information should process the results of an appropriate query 
of unminimized section 702-acquired information in accordance with NSA’s applicable section 
702 minimization procedures. 

II. (U) If NSA determines that it must take action in apparent departure from these querying 
procedures to protect against an immediate threat to human life (e.g., force protection or hostage 
situations) and that it is not feasible to obtain a timely modification of these procedures, NSA 
may take such action immediately. NSA will make a record of the action taken, to include any 
query term(s) used, and report the action taken to the Office of the Director of National 
Intelligence (“ODNI”) and to the Department of Justice’s National Security Division (“NSD”), 
which will promptly notify the Foreign Intelligence Surveillance Court (“FISC”) of such activity. 

III. (U) Definitions and Presumptions 

A. (U) Definitions for purposes of these procedures 

(U) These procedures adopt the definitions set forth in 50 U.S.C. § 1801 for the terms 
“foreign intelligence information,” “person,” “United States,” and “United States person.” 

(6//NF) 

(Uf W hen used to conduct a query, “United States person query term” means a term that is 
reasonably likely to identify one or more specific United States persons. United States 
person query terms may be either a single item of information or information that, when 
combined with other information, is reasonably likely to identify one or more specific United 
States persons. Determining whether information is reasonably likely to identify one or more 
specific United States persons in a particular context may require a case-by-case assessment 
by a trained intelligence professional. “United States person query term” is not limited to 
any single category of information or technology. Depending on the context, examples of 
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United States person query terms may include: names 0 | 
associate^personal or corporate identification i^j 
| and street address, telephone, and H 
United States person query term does not include a reference to a product by brand or 
manufacturer’s name (or related nomenclature, including part numbers) or the use of a name 
in a descriptive sense, as, for example, “Ford Crown Victoria” or “Boeing 737,” so long as 
such term is not intended to retrieve information concerning a specific United States person 
(e.g., “Ford Crown Victoria with License Plate Number CBA 321”). 


(U) “Query” means the use of one or more terms 1 to retrieve the unminimized contents or 
noncontents (including metadata) of section 702-acquired information that is located in an 
NS A system. The term “query” does not include a user’s query of a system that contains 
unminimized section 702-acquired information, where the user does not receive unminimized 
section 702-acquired information in response to the query either because the user has not 
been granted access to the unminimized section 702-acquired information, or because a user 
who has been granted such access has limited the query such that it cannot retrieve 
unminimized section 702-acquired information. The term “query” also does not include (1) a 
system user’s actions subsequent to conducting a query for purposes of sorting the results of 
that query based upon the attributes of the information retrieved, 2 or (2) examining or 
manipulating, including by technical means, communications or documents for the purpose 
of minimizing such communications or documents. 3 

(U) “Contents” means any information concerning the substance, purport, or meaning of a 
communication. 


(U) “Metadata” means the dialing, routing, addressing, or signaling information associated 
with a communication, but does not include information concerning the substance, purport, 
or meaning of the communication. 

(U) The terms “National Security Agency” and “NSA personnel” refer to any employees of 
the National Security Agency/Central Security Service (“NSA/CSS” or “NSA”) and any 
other personnel engaged in Signals Intelligence (SIGINT) operations authorized pursuant to 
section 702 of the Act if such operations are executed under the direction, authority, or 
control of the Director, NSA/Chief, CSS (DIRNSA). 



2 (U) For example, the action of a system user to sort the results of a query (i.e., the information actually 
returned to a system user from a query) by date, time, etc. 


3 (U) For example, an analyst might run a script against a spreadsheet that would find and replace all 
instances of a known United States person’s name with a generic term, such as “U.S. Person 1.” 


DATE: Oct 8,2019 - Authorized Public Release 


2 

Page 2 of 6 


NSA's Section 702 Querying Procedures, Sep 2018 







Document regarding the Section 702 2018 Certification 


3ECRET//NOFORN 


ODNI Authorized for Public Release 


B. (U) Presumptions for purposes of these procedures 

(U) The following guidelines apply in determining whether a person whose status is 
unknown is a United States person: 

1. (U) A person known to be currently in the United States will be treated as a United 
States person unless positively identified as an alien who has not been admitted for 
permanent residence, or unless the nature or circumstances of the person’s 
communications give rise to a reasonable belief that such person is not a United 
States person. 

2. (U) A person known to be currently outside the United States, or whose location is 
unknown, will not be treated as a United States person unless such person can be 
positively identified as such, or the nature or circumstances of the person’s 
communications give rise to a reasonable belief that such person is a United States 
person. 

3. (U) A person who at any time has been known to have been an alien admitted for 
lawful permanent residence is treated as a United States person, unless a 
determination that such person is no longer a United States person is made in 
consultation with the NS A Office of General Counsel. 

4. (U) An unincorporated association whose headquarters or primary office is located 
outside the United States is presumed not to be a United States person unless there is 
information indicating that a substantial number of its members are citizens of the 
United States or aliens lawfully admitted for permanent residence. 

(U) IV. Querying Procedures 
A. (U) Query Standard 

(U) Each query of NS A systems containing unminimized content or noncontent information 
acquired pursuant to section 702 of the Act must be reasonably likely to retrieve foreign 
intelligence information, as defined by FISA, unless otherwise specifically excepted in these 
procedures. Any United States person query term used to identify and select unminimized 
section 702-acquired content must first be approved by NSA’s Office of General Counsel. 

NS A personnel seeking such an approval must provide a statement of facts establishing that 
the use of any such identifier as a selection term is reasonably likely to retrieve foreign 
intelligence information, as defined by FISA. NS A may approve the use of a United States 
person query term to query unminimized section 702-acquired content for no longer than a 
period of one year; such approvals may be renewed for periods up to one year. Any use of a 
United States person query term to query unminimized section 702-acquired metadata must 
be accompanied by a statement of facts showing that the use of any such query term is 
reasonably likely to retrieve foreign intelligence information, as defined by FISA. Internet 
transactions, as defined in NSA’s section 702 minimization procedures, acquired on or before 
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March 17, 2017, will be sequestered in NS A systems to prevent NS A analysts from accessing 
or using computer selection terms to scan such transactions until such transactions are 
destroyed. 

B. (U) Creation and Maintenance of Query Records 

1. (U) NSA must generate and maintain an electronic record of each United States 
person query term used for a query of unminimized information acquired pursuant to 
section 702. Such electronic record must, at a minimum, include the following 
information: 

a. (U) the query term(s) used or approved; 

b. (U) the date of the query or approval of query term(s); 

c. (U) the identifier of the user who conducted the query or sought approval of 
the query term(s); 

d. (U) the statement of facts showing that the use of the query term(s) is 
reasonably likely to retrieve foreign intelligence information, as defined by 
FISA; and 

e. (U) in the case of content queries, the approving official in NSA’s Office of 
General Counsel and duration of the approval. 

2. (U) In the event it is impracticable for an NSA system to generate an electronic 
record, or in the event an unanticipated circumstance arises that prevents the 
generation of such an electronic record, NSA must generate and maintain a written 
record of each United States person query term that contains the same information 
required for electronic records, as described above. Before conducting a query in a 
system that does not generate an electronic record of a query, NSA personnel must 
reasonably determine that conducting that query in a system that generates an 
electronic record would be insufficient for technical, analytical, operational, or 
security reasons. 

3. (U) NSA will maintain the query records required by this subsection in a manner that 
will allow NSD and ODNI to conduct oversight and compliance in an effective 
manner. Such records (both electronic and written), including the statements of facts, 
must be maintained at least five years from either the date of the query for queries of 
unminimized section 702-acquired metadata, or the date of the approval of the U.S. 
person query term for queries of unminimized section 702-acquired content. NSD 
and ODNI will conduct oversight of NSA’s activities with respect to United States 
persons that are conducted pursuant to these procedures. 
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C. (U) Exceptions. Notwithstanding subsections IV.A and IV.B.l.d-e above, nothing in 
these procedures shall prohibit the lawful oversight functions of NSD or ODNI, or the 
applicable Offices of the Inspectors General, or restrict NS A from providing the 
assistance necessary for these entities to perform their lawful oversight functions, and 
nothing in these procedures shall prohibit NS A from conducting queries it determines are 
necessary to: 

1. (U) NSA’s performance of lawful training functions of its personnel regarding the 
proper implementation of section 702 and NSA’s section 702 procedures. However, 
NS A shall use non-Uni ted States person identifiers to perform such queries, unless 
NSA determines that there is a particular need to use a United States person identifier 
in such a query to conduct training on the implementation of an aspect of NSA’s 
section 702 procedures; 

2. (U) create, test, or conduct technical maintenance of NSA systems that process or 
store section 702-acquired information; 

3. (U) comply with an order of a court within the United States or a specific 
congressional mandate, such as a subpoena or similar process consistent with 
congressional oversight; 

4. (U) conduct vulnerability or network assessments using information acquired 
pursuant to section 702 of the Act in order to ensure that its systems are not or have 
not been compromised; 

5. (U) identify information that must be produced or preserved in connection with a 
litigation matter; or 

6. (U) perform the following lawful oversight functions of NSA’s personnel or systems: 

a. (U) support NSA’s investigation and remediation of a possible section 702 
compliance incident; 

b. (U) remediate a potential spill of classified section 702-acquired information 
in NSA systems; 

c. (U) identify section 702-acquired information subject to destruction, 
including under NSA’s section 702 minimization procedures; 

d. (U) ensure the effective application of marking or segregation requirements 
in NSA’s section 702 minimization procedures; 

e. (U) support NSA’s audit or review, for quality control purposes, of work 
done related to section 702 collection by NSA personnel; 

(U) Should NSA determine that it is necessary to deviate from an aspect of these 
procedures to perform lawful oversight functions of its personnel or systems apart 
from those specified in this subsection (IV.C.6), NSA shall consult with NSD and 
ODNI prior to conducting such a query. NSD shall promptly report the deviation to 
the FISC. Each such report shall describe the nature of the deviation from the 
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procedures and identify the specific oversight activity for which the deviation was 
necessary. 

(U) Consistent with the requirements set forth in subsections IV.B.l.a-c, 2, and 3 above, 
NS A must keep a record of any United States person query term used for a query of 
unminimized section 702-acquired information in support of the activities described in this 
subsection IV.C. 
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